lesser known dns tools and bind tricks - …cas/bind-tricks-talk/lesser-known...8/4/12 lesser known...

8/4/12 Lesser known DNS tools and BIND tricks

1/56file:///home/cas/talk/bind-tricks/html/dns-tricks.html

Lesser known DNS tools andBIND tricksdnsworkshop.org

August 2012



About me



6502BasicForthAssembler



8086MSDOSPascalCAssembler



Power CPUAS/400CLRPGSNA



386OS/2RexxModulaOberonJavaNetBIOS



UnixSolarisLinuxOpenBSDFreeBSDTCP/IP



NetworkDNSDHCPIPv6DNSSEC



WorkMen & MiceISCLinuxHotel



DNS lookup



quick DNS lookupDNS lookup tool, easy to parse output

dnsget guug.de

or

dig guug.de +short



pretty print DNSpretty print dns results

dig soa dnsworkshop.org +multiline



checking SOA recordslookup SOA record from all authoritative DNS servers of a zone

dig dnsworkshop.org +nssearch



map DNS names in a zonebrute force map all DNS names in a zone

dnsmap guug.de



bulk resolve namesasynchronous DNS to resolve names (or IP addresses to names) in logfiles

cat queryfileexample1million | head | adnshost af



DNS resolve filterresolve IP addresses to names in a filter

lsof i n | adnsresfilter



browse multicast DNSBonjour / Rendezvous / Avahi DNS service discovery browser

avahibrowse

or

mdnsscan



mailserver for a domainquick find the mailserver for a domain

ldnsmx isc.org



a terse display of a zoneprint a parseable tree view of a DNS zone

dns_tree gnu.org



graphical DNS and DNSSEClookup tool



monitoring



find version of serverprint the version information reported by a DNS server

ldnschaos f.rootservers.net



fingerprint DNS serversfind server software and versions by fingerprinting DNS responses

fpdns Df google.com



measure DNS latencymeasure the DNS response time

echoping n 20 m dns 8.8.8.8 dnsworkshop.org



monitor DNS queriesmonitor all DNS queries seen by the local machine

sudo dnstop l 3 eth0



monitor or capture DNS queriesdnscap is a traffic capturing tool for DNS

sudo dnscap g



visualize DNS traffic flow# sudo tcpdump i eth0 w dnsdump.pcap port 53# dnspktflow dnsdump.pcap# eog out.png



troubleshooting



trace the delegation treedig dnsworkshop.org +trace

or

dnstracer s . www.dnsworkshop.org



check a domain for issuesdownload a zonefile and checks for issues

dnswalk gnu.org.



check your zone for errorsthe zonecheck tool (on the Internet or installed locally)



visualize a DNS zone# dig @ns2.gnu.org. axfr gnu.org +onesoa > gnu.orgzone# mapper gnu.orgzone gnu.org# eog map.png



DNSSEC



check resolver for DNSSECcompliance



SSH fingerprint resource recordsgenerate sshfp records from your knownhosts file

sshfp



Walk a NSEC signed zonetraverse all domain names in a zone that is NSEC signed

ldnswalk paypal.com

or

walker paypal.com



trace the 'chainoftrust'tracing the chain of trust to the root trust anchor

# drill dnskey . | grep 257 > root.key# drill SD k root.key www.ripe.net



peek into a validating resolverunboundhost lets you view every step of DNSSEC validation

unboundhost C /etc/unbound/unbound.conf dvv www.isc.org



sanity check a DNSSEC signedzone

check a DNSSEC signed zone for issues

donuts r "/usr/share/dnssectools/donuts/rules/*.txt" \ dnsworkshop.orgzonefile dnsworkshop.org

or

ldnsverify dnsworkshop.orgzonefile



BIND



statistics channel over httpacl myadmins 192.0.2.100; 192.0.2.101; ;

statisticschannels inet * port 8053 allow myadmins; ;;



check config + zonefiles beforereload

verify named.conf (and all zonefiles loaded) for syntax errors

namedcheckconf z



pretty print a configuration fileif you see a messedup BIND config, pretty print it

namedcheckconf p > named.conf



pretty print the canonical form ofa zone

some errors are hiding in shortcuts

namedcheckzone D problemdomain.com problemdomain.comzone



tune the concurrent client settingadjust recursive clients to real world value on a busy caching DNSserver

options [...] recursiveclients 2000; tcpclients 200;;



limit the size of the cachea BIND caching DNS server gets slower with a large cache (> 2GB)

options [...] maxcachesize 2147483648; // 2GB max cache;



compile zones to binary formatfor fast startup

compile a textversion of a zone to "raw" binary format

# namedcompilezone F raw o gnu.orgraw gnu.org gnu.orgzone zone gnu.org/IN: loaded serial 2011071556dump zone to gnu.orgraw...doneOK

and in named.conf

zone "example.com" type master; file "example.com.raw"; masterfileformat raw;;



convert from RAW zone formatto text format

BIND 9.9.x+ creates RAW files by default (for slave and stubzones)

namedcompilezone f raw o slave.example.orgtext \ slave.example.org slave.example.org

this command turns them into RFC 1035 text format



print the content of a journal fileBIND collects changes for dynamic zones in a binary journal file

namedjournalprint dynamic.signed.dnslab.org.jnl



simple dynamic zone setup(BIND 9.7.2+)

enable dynamic updates

zone "example.com" type master; file "example.comzone"; updatepolicy local;;

and use "nsupdate" to make changes to the zone (from the DNS servermachine)

# nsupdate l> update add www.example.com. 3600 IN A 192.0.2.80> update delete old.example.com. A> send



FUN



Bert's Secure Reverse PolishDNS Calculator (BSRPDNSC)

Try Bert's Secure Reverse Polish DNS Calculator (BSRPDNSC). Thisis nice because you don't need your HP48 or Forth to do serious RPNcalculations:

# dig "9.dup.*.rp.secretwg.org" TXT



Wikipedia over DNSno web browser to lookup things in Wikipedia? Use DNS

# dig txt guug.wp.dg.cx



Query the lastest twitter newsover DNS

who needs a twitter client?

dig guug.twitter.any.io txt +short



Thank you

[email protected]

Links to the tools and webpages mentionedin this talk can be found on dnsworkshop.org

lesser known dns tools and bind tricks - …cas/bind-tricks-talk/lesser-known...8/4/12 lesser known...

Documents